|
I have an application that consists of four different
programs that all talk to each other via TCP sockets… Similar to the
diagram:
+---------+ +-------|
ServerA |------+
| +---------+
|
|
| | +----------------+ | +---------+
| UserApp Client |---|-----| ServerB |
+----------------+ | +---------+
|
| |
|
| |
| +--------+
| +-------|
Logger |------+
+--------+ The ServerA, ServerB, and Logger all run from xinetd. The "UserApp Client" is the only program
directly executed via the user. All programs read from a common settings file in /etc. With Fedora Core 9, I've used the polgengui to create
initial policies for the four programs. Then since they share the settings file, I edited the
definitions so that configuration file is not specific to any one of the
programs. They all need to share port information, so I added require
{ myservera_port_t; myserverb_port_t; mylogger_port_t } statements to each .te
file. That seems to work on FC9, but on RedHat EL 5.2, when
attempting to load myservera, it complains: /usr/sbin/semodule -i myservera.pp libsepol.print_missing_requirements: myservera's global
requirements were not met: type/attribute myserverb_port_t libsemanage.semanage_link_sandbox: Link packages failed /usr/sbin/semodule: Failed! Attempting to load myserverB first ends up with the same
complaint about the serverA's port_t being undefined. I had kept the .te files for the four programs separate…
but this message makes me think that maybe I need to combine them. Is
that necessary? Or is there a way to pre-define the ports before the
"require from somewhere else" statement? For my four programs, should I have four distinct policy_module
statements? Is it possible to have multiple policy_module statements in
the same .te file? Also, I seem to be having domain transfer problems. I added this following code to each .te file: domain_auto_trans(unconfined_t,
myapp_exec_t, myapp_t ) allow unconfined_t myapp_t:fd
use; allow myapp_t
unconfined_t:fifo_file rw_file_perms; allow myapp_t
unconfined_t:process sigchld; however, each process still runs as follows: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
32504 pts/4 00:00:00 myapp unconfined_u:system_r:inetd_child_t:s0-s0:c0.c1023 32508
? 00:00:00 myserverb unconfined_u:system_r:inetd_child_t:s0-s0:c0.c1023 32512
? 00:00:00 mylogger For the inetd daemons, is this something I should try to
fix, or is unconfined_u:system_r:inetd_child_t "secure enough"? Any suggestions for getting the myapp domain transferred? Thanks, Brian |
-- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-selinux-list
